H3-2026-0063¶

Cisco Unified Communications Manager Tomcat Manager Hardcoded Credentials Vulnerability

Description¶

Cisco Unified Communications Manager 15.x fronts an Apache Tomcat instance behind HAProxy. Tomcat's RemoteIpValve is configured without an internalProxies restriction, so a client-supplied X-Forwarded-For: 127.0.0.1 header overrides the observed remote address and bypasses the RemoteAddrValve localhost restriction that guards the Tomcat Manager application. Combined with manager-script credentials that ship identically hardcoded on every install, an unauthenticated attacker can reach the /manager/text interface and deploy a WAR file for remote code execution.

Impact¶

An unauthenticated attacker who can reach the web interface can access the Tomcat Manager text interface using the hardcoded credentials and deploy a WAR file, gaining remote code execution as the tomcat user, with a documented privilege escalation path to root.

References¶

• CWE-798: Use of Hard-coded Credentials
• CWE-290: Authentication Bypass by Spoofing
• MITRE ATT&CK Technique: T1078.001: Valid Accounts: Default Accounts